Wireless evolution: WEP (broken, 1997) → WPA-TKIP (2003, deprecated) → WPA2-CCMP/AES (2004, current minimum) → WPA3-SAE (2018, current best). Enterprise adds 802.1X+RADIUS for per-user authentication.
Never use WEP or WPA (TKIP). WPA2-Enterprise (802.1X) is the enterprise minimum. WPA3-SAE prevents offline dictionary attacks against the PSK. WPA3-OWE (Opportunistic Wireless Encryption) encrypts open networks without a password. Upgrade to WPA3 when hardware supports it.